TheGentlemen

The Gentlemen is a ransomware-as-a-service operation that emerged in mid-2025 and rapidly became one of the most active ransomware groups in 2026. Reporting indicates the group grew out of personnel previously associated with Qilin before operating independently. Internal leak material exposed a compact core team of roughly nine operators supported by a broader affiliate base, consistent with a RaaS model in which most intrusions were conducted by partners and revenue was shared with affiliates. The group conducts financially motivated double-extortion operations, combining data theft with system encryption and public leak-site pressure. Its activity has been especially prominent in South America, where it has been identified as the leading ransomware actor in that sub-region, while also maintaining substantial activity in North America and additional victims across Europe, Asia, and Oceania. Confirmed victim geography includes the United States, Brazil, Australia, Switzerland, Italy, Malaysia, and Japan among many others. Observed victim sectors include retail, healthcare, professional services, hospitality, environmental services, and organizations assessed as operationally sensitive or business-critical. The Gentlemen’s intrusion tradecraft relies primarily on established access paths rather than novel exploitation. Reported initial access methods include scanning for exposed SSL VPN infrastructure, brute-force activity, and acquisition or abuse of stolen credentials from access brokers. Leaked internal discussions also indicate deliberate target selection using external business intelligence to assess industry, revenue, geography, and likely pressure to pay. Once inside a network, the group has been observed performing internal reconnaissance, abusing Active Directory for privilege escalation and domain control, moving laterally across systems, disabling or evading endpoint defenses, locating and disrupting backups, exfiltrating data, and then deploying ransomware. The leaked operational material further showed that the group regarded initial access and lateral movement as more challenging than the final encryption phase, and that it actively shared techniques for reconnaissance, defense evasion, and backup interference. The same material indicated use of AI coding assistants to accelerate development of its ransomware management panel, reportedly reducing build time to only a few days. This reflects operational efficiency rather than novel capability, but it underscores the group’s ability to scale quickly. Known aliases include gentleman, gentlemen, gentleman_group, gentlemen_ransomware_group, gentlemen_raas_affiliates, Storm-2697, the_gentleman, and the_gentlemen.